a047cac02a9c4c0d986197329ea3a30f.s1.eu.hivemq.cloud, 54.73.92.158:8883

TLS Test Results from September 05 2022 07:43:01 UTC. Scan took 71 seconds.

Summary

Finding Severity Result
Service DEBUG Couldn't determine service, skipping all HTTP checks
OCSP Revoked WARN
TLS 1.2 OK offered
TLS 1.3 INFO not offered + downgraded to weaker protocol
Perfect Forward Secrecy OK offered
Common Name (CN) OK *.s1.eu.hivemq.cloud
Subject Alternative Name (SAN) INFO
  • *.s1.eu.hivemq.cloud
  • s1.eu.hivemq.cloud
CA Issuers INFO R3 (Let's Encrypt from US)
Valid Not After OK 2022-10-06 12:35

Protocols

Version Status
SSL v2 not offered
SSL v3 not offered
TLS 1.0 not offered
TLS 1.1 not offered
TLS 1.2 offered
TLS 1.3 not offered + downgraded to weaker protocol
ALPN / HTTP2 not offered

Cipher Categories

Category Status
NULL ciphers (no encryption) not offered
Anonymous NULL Ciphers (no authentication) not offered
Export ciphers (excluding ADH+NULL) not offered
LOW: 64 Bit + DES, RC[2,4] (excluding export) not offered
Triple DES Ciphers / IDEA not offered
Obsolete CBC ciphers (AES, ARIA etc.) offered
Strong encryption (AEAD ciphers) offered

Perfect Forward Secrecy

Category Status
Perfect Forward Secrecy offered
PFS Ciphers
  • ECDHE-RSA-AES128-GCM-SHA256
  • ECDHE-RSA-AES128-SHA
  • ECDHE-RSA-AES256-GCM-SHA384
  • ECDHE-RSA-AES256-SHA
PFS ECDHE Curves
  • prime256v1
  • secp384r1
  • secp521r1

Server Preferences

Category Finding
Cipher Order server
Protocol Negotiated Default protocol TLS1.2
Cipher Negotiated ECDHE-RSA-AES128-GCM-SHA256, 256 bit ECDH (P-256)
Cipher Order TLS v1.2 ECDHE-RSA-AES128-GCM-SHA256

Server Defaults

Category Finding
TLS Extensions
  • server name/#0
  • renegotiation info/#65281
  • EC point formats/#11
  • extended master secret/#23
TLS Session Ticket no -- no lifetime advertised
SSL Session-ID Support yes
Session Resumption Ticket not supported
Session Resumption ID supported
TLS Timestamp off by -1 seconds from your localtime
Number of Certificates 1

Certificate

Category Finding
Signature Algorithm SHA256 with RSA
Key Size RSA 2048 bits
Key Usage
  • Digital Signature
  • Key Encipherment
Extended Key Usage
  • TLS Web Server Authentication
  • TLS Web Client Authentication
Serial Number 04A1E3068F30F9335D1B867A25ABADFBF759
SHA1 Fingerprint 2892737816C66E7F918C9B49D4C62CC8FF740A9B
SHA256 Fingerprint 224D5FBA95D212C2086C9A634C29EB835116BD05FEB6E7242362D3B8CE40E2B3
X.509 Certificate Download a047cac02a9c4c0d986197329ea3a30f.s1.eu.hivemq.cloud_8883_28927378.pem
Common Name (CN) *.s1.eu.hivemq.cloud
Common Name w/o SNI *.s1.eu.hivemq.cloud
Subject Alternative Name (SAN)
  • *.s1.eu.hivemq.cloud
  • s1.eu.hivemq.cloud
CA Issuers R3 (Let's Encrypt from US)
Certificate Trust Ok via SAN wildcard (same w/o SNI)
Chain Of Trust passed.
Extended-Validation Policies no
ETS (prev. "eTLS") not present
Expiration Status 31 >= 30 days
Valid Not Before 2022-07-08 12:36
Valid Not After 2022-10-06 12:35
Validity Period No finding
Certificate Count Server 3
Certs List Ordering Problem no
Leaked Key (pwnedkeys) not in database
CRL Distribution Points
  • --
OCSP Revoked
OCSP URL http://r3.o.lencr.org
OCSP Stapling not offered
OCSP Must Staple Extension --
DNS CAA Record
  • --
Certificate Transparency yes (certificate extension)

Vulnerabilities

Category Finding
Heartbleed not vulnerable, no heartbeat extension
CCS not vulnerable
Ticketbleed not applicable, not HTTP
ROBOT not vulnerable
Secure Renegotiation supported
Secure Client Renegotiation not vulnerable
CRIME TLS not vulnerable (not using HTTP anyway)
POODLE SSL not vulnerable, no SSLv3
Fallback SCSV no protocol below TLS 1.2 offered
SWEET32 not vulnerable
FREAK not vulnerable
DROWN not vulnerable on this host and port
DROWN Hint Make sure you don't use this certificate elsewhere with SSLv2 enabled services, see censys.io
LOGJAM not vulnerable, no DH EXPORT ciphers,
LOGJAM Common Primes no DH key with <= TLS 1.2
BEAST not vulnerable, no SSL3 or TLS1
LUCKY13 potentially vulnerable, uses TLS CBC ciphers
RC4 not vulnerable

Ciphers

Name Key Exchange Encryption Key Length IANA ID
ECDHE-RSA-AES256-GCM-SHA384 ECDH 256 AESGCM 256 xc030
ECDHE-RSA-AES256-SHA ECDH 256 AES 256 xc014
AES256-SHA RSA AES 256 x35
ECDHE-RSA-AES128-GCM-SHA256 ECDH 256 AESGCM 128 xc02f
ECDHE-RSA-AES128-SHA ECDH 256 AES 128 xc013
AES128-GCM-SHA256 RSA AESGCM 128 x9c
AES128-SHA RSA AES 128 x2f

Client Simulation

Category Connection via
Android 4.4.2 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256
Android 5.0 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256
Android 6.0 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256
Android 7.0 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256
Android 8.1 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256
Android 9.0 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256
Android X TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256
Chrome 74 Windows 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256
Chrome 79 Windows 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256
Firefox 66 Windows 8.1/10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256
Firefox 71 Windows 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256
IE 6 Windows XP No connection
IE 8 Windows 7 No connection
IE 8 Windows XP No connection
IE 11 Windows 7 TLSv1.2 ECDHE-RSA-AES128-SHA
IE 11 Windows 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA
IE 11 Windows Phone 8.1 TLSv1.2 ECDHE-RSA-AES128-SHA
IE 11 Windows 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256
Edge 15 Windows 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256
Edge 17 Windows 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256
Opera 66 Windows 10 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256
Safari 9 IOS9 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256
Safari 9 OSX 10.11 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256
Safari 10 OSX 10.12 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256
Safari 12.1 iOS 12.2 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256
Safari 13.0 OSX 10.14.6 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256
Apple ATS 9 IOS9 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256
Java 6u45 No connection
Java 7u25 No connection
Java 8u161 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256
Java 11.0.2 (OpenJDK) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256
Java 12.0.1 (OpenJDK) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256
OpenSSL 1.02e TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256
OpenSSL 1.10l (Debian) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256
OpenSSL 1.11d (Debian) TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256
Thunderbird 68.3 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256